Microsoft Exchange SSRF Vulnerability Exposed — PoC Exploit Now Public

HawkTrace reveals high-severity SSRF flaw CVE-2026-45504 in on-premises Microsoft Exchange. Patch urgently to prevent unauthorized file access.

By Content Team

Jul 4, 2026

ON THIS PAGE

Security researchers at HawkTrace have disclosed a high-severity SSRF vulnerability in Microsoft Exchange, tracked as CVE-2026-45504 with a CVSS score of 8.8. The flaw lets authenticated low-privileged users read arbitrary files from on-premises Exchange servers — think credentials, config files, and internal service data. Exchange Online is not affected.

The attack exploits how Exchange handles attachment previews via its OneDriveProUtilities component, passing user-controlled URLs into HTTP requests without proper validation. A simple file:// URI with a fragment character (#) bypasses protections entirely.

A working PoC is now live on GitHub, making patching urgent. Check Microsoft's advisory for the affected builds and the update that fixes them, and block Exchange from reaching untrusted external endpoints in the meantime.

Source: Cybersecurity News

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?